Areas of Expertise
Software Security | Cloud Security | Threat Modeling | Architectural Risk Analysis | Software-Defined Security Governance | Security Automation | Supply Chain and AI Security
About John
John Steven is a pioneering voice in software and cloud security, with more than three decades of experience shaping the way organizations build and secure technology. At The Chertoff Group, he counsels Cybersecurity customers on threat modeling, architectural risk analysis, software-defined security governance and automation strategies that drive efficiency and resilience.
Recent Engagements
- Provided technical advisory support for building a trusted software assurance architecture and operational capability, leveraging agentic AI to scale implementation for a major software company
- Provided technical subject matter expertise to conduct risk-baseline review of a major software provider’s development lifecycle
Career Highlights
- Co-CTO of Cigital, transforming the company into the largest and most influential application security firm in the industry, where the company introduced the methodologies, tools and thought leadership that defined modern software security
- Contributing author to the Building Security In Maturity Model (BSIMM), which became the global benchmark for software security programs and informed the NIST Secure Software Development Framework
- Partners with enterprises to advance secure software development and governance, recognized for his strategic impact and technical depth, with continuing influence on security strategy for Fortune 500 companies, high-growth innovators and the broader cybersecurity ecosystem
- Advisory CTO or CRO for multiple startups in the cloud security and application security posture management space, contributing to several successful exits
Active advisor to startups in supply chain security and AI
Education
M.S. in Computer Science, Case Western Reserve University | B.S. in Computer Engineering, Case Western Reserve University